Deployment Architecture

I want to save my indexer disk space and how can I route all my internal log to a 3rd party server

daniel_splunk
Splunk Employee
Splunk Employee

I want to save my indexer disk space. I setup another server to store all my splunk internal log. How can I route all my internal log to a 3rd party server?

Tags (1)
0 Karma

nickhills
Ultra Champion

I think it obvious, but clearly, using the approach above, you wont be able to search this data in splunk since it will never actually get indexed. - That may be ok for you, but since you didn't specify...
-or-
If you have the space on a 3rd party system (lets say a commodity NAS) you could install splunk on another server and present the NAS storage to splunk, and create your indexes there.

Using _TCP_ROUTING as above, you can send your internal (or less searched) data to the second splunk server, which will keep it separate and on the NAS

You can then either use the second server to review your internal logs, or add it as a search peer of your first server (or SH) and have one Search Interface for all of your data - accepting that your internal logs will be less performant than your main indexes.

If my comment helps, please give it a thumbs up!
0 Karma

daniel_splunk
Splunk Employee
Splunk Employee

You can use _TCP_ROUTING in your inputs.conf to route to different output group. Below are some sample configuration.

inputs.conf
[monitor://$SPLUNK_HOME/var/log/splunk]
index = _internal
_TCP_ROUTING = tcp_3rdparty

outputs.conf
[tcpout]
indexAndForward = false
defaultGroup = noSuchOutputGroup

[tcpout:tcp_3rdparty]
server = 192.168.1.165:22222
blockOnCloning = false
dropEventsOnQueueFull = 5
sendCookedData = false

Remark: You can use netcat to test the setup before you setup the 3rd party server
E.g.
nc -l 22222

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...